CVE-2025-39389CWE-89

WordPress AnalyticsWP <= 2.1.2 - SQL Injection Vulnerability

Critical · published May 19, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection vulnerability lurks in AnalyticsWP, putting your data at risk with devastating ease! 🔥 Think of it like a restaurant where the chef blindly follows any strange order that comes through the system—one unusual request could lead to a disastrous dish that ruins the whole meal! 🍽️ An attacker could exploit this vulnerability to manipulate SQL queries, gaining unauthorized access to sensitive data or even altering your database completely. Imagine them walking through the kitchen door and tampering with every recipe on the menu—an absolute nightmare for your data integrity!

Put simply

Think of it like a restaurant where the chef blindly follows any strange order that comes through the system—one unusual request could lead to a disastrous dish that ruins the whole meal! 🍽️ This SQL injection flaw occurs due to improper neutralization of special elements in SQL commands, enabling attackers to execute arbitrary SQL code on your database. Affected versions range from n/a through 2.1.2, making it critical for users to address immediately.

What to do

An attacker could exploit this vulnerability to manipulate SQL queries, gaining unauthorized access to sensitive data or even altering your database completely. Imagine them walking through the kitchen door and tampering with every recipe on the menu—an absolute nightmare for your data integrity! To safeguard your systems, patch AnalyticsWP to the latest version to eliminate this vulnerability. Additionally, ensure you use prepared statements to prevent injection attacks and regularly audit your database interactions for safety. You've got this! Taking these steps can secure your database and protect your data integrity. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-05-19T19:31Z
EPSS history
Timeline
  • 19 MAY 19:31Z
    WordPress AnalyticsWP <= 2.1.2 - SQL Injection Vulnerability
    cvelistv5